Search: CVE-2026-42502

CVE-2026-42502 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This affects applications that sanitize input HTML before rendering, resulting in improper neutralization of input during web page generation. There is no official patch or remediation guidance available yet, and no known exploits have been reported in the wild.